Connectivity
The outermost layer, and the one whose failure is total for a site and invisible everywhere else. It answers a single question: can a call happen at all.
- Keeps the phone system you already own
- Concurrency from measurement, not headcount
- Multiple routes, selected per call
What this layer does
It carries signalling and media between your phone system and the public network over IP, in place of a physical circuit. Two things travel: the instructions that set a call up, and the audio itself.
Because the connection is logical, capacity is a configuration value rather than a count of installed channels. That single fact changes the economics — you stop buying blocks and paying for the unused portion indefinitely — and it changes the timescale, because thirty channels become sixty in minutes rather than weeks.
It is normally the first layer fitted, because nothing on anybody's desk changes. The phone on the desk behaves identically; what alters is what sits behind it.
The layers within
Four sub-boundaries, each with its own protection.
Authorisation
Establishing that your phone system is what it claims to beAddress-based for fixed sites, which removes the credential rather than protecting it. Nothing to leak from a configuration backup or a departing administrator.
Transport
Carrying signalling and audio without exposureTLS for signalling and SRTP for media wherever the endpoint supports them. Where one cannot, the exception is recorded rather than silently accepted.
Selection
Choosing the way out, per callMultiple upstream paths evaluated on completion rate and audio quality rather than reachability alone. A route that answers and then delivers poor audio is withdrawn.
Containment
Bounding what a compromise can costDestinations denied by default, concurrency ceilings enforced, and spend thresholds that stop traffic rather than send an email.
- Automated scanning finding an exposed registration endpoint within hours
- Toll fraud initiated outside working hours, exploiting detection latency
- An upstream route that degrades rather than fails, delivering audio nobody can use
- A site outage rendering published numbers unreachable with no agreed fallback
- Capacity exhaustion at peak, presenting as blocked calls rather than as poor audio
What this layer protects against
The threats at this boundary are specific and well understood, which is why the defaults are restrictive rather than convenient.
How it is fitted
A few weeks, most of it waiting for number ports rather than technical work.
-
Measure
Concurrency reconstructed from call records in short intervals across a representative period. Headcount is not an input.
-
Specify
Routing, failover destinations and containment thresholds written down and agreed before provisioning.
-
Prove
A trial trunk against your phone system exercised with representative call flows, including deliberate failover.
-
Fit
Numbers ported on a scheduled date; traffic moved in waves with the previous path retained until verified.
-
Hold
After one billing period, measured concurrency compared against the model and the sizing corrected.
What this layer produces
Per-call quality records
Jitter, packet loss, round-trip time and completion cause, retained, so a quality dispute becomes a query.
Route health history
Which paths were withdrawn, when and why, available at service review.
Configuration records
Authorised addresses, transport settings and any recorded encryption exception.
Threshold and alert log
What the containment thresholds are set to and every occasion they acted.
No. This layer sits beneath whatever you already have, provided it speaks SIP or can sit behind a gateway. Keeping the existing system is the usual reason this layer is fitted first.
From your call records, reconstructed in short intervals across a representative period, producing a distribution rather than a single figure. Hourly averages suppress the peaks that actually block callers.
Inbound follows the failover agreed at specification — another site, a mobile group or an announcement — invoked automatically. Outbound at that site is unavailable until the circuit returns. The failure does not reach any other site.
Because a route that answers and then delivers unusable audio is worse than one that refuses cleanly. Reachability is a low bar and we do not use it as the health test.
Yes, as a recorded decision attributable to a named person and revisited at the next review. Not as something that quietly happens because a threshold was inconvenient once.